Cannot Delete AWS Directory Service (SimpleAD)

Question

Hi AWS Community,

I’m trying to delete a SimpleAD directory in AWS Directory Service

What I Have Tried:

I have already checked and removed possible dependencies that could be blocking the deletion. Here’s a summary of what I have done:
	1.	Verified AWS WorkSpaces:
	•	No WorkSpaces are associated with this directory.
	2.	Checked Amazon FSx and RDS SQL Server:
	•	No FSx file systems or SQL Server databases are using this directory.
	3.	Deleted AWS SSO Instance:
	•	Successfully deleted AWS SSO, but the issue persists.
	4.	Verified IAM Roles and Policies:
	•	No IAM roles or policies reference this directory.
	5.	Checked AWS Organizations:
	•	The directory is not linked to AWS Organizations or AWS Control Tower.
	6.	Reviewed AWS Resource Groups and Tags:
	•	No resources found using aws resourcegroupstaggingapi get-resources.
	7.	Verified and Removed Conditional Forwarders and Trusts:
	•	No trust relationships or conditional forwarders exist.
	8.	Checked AWS Cognito:
	•	Found a linked Cognito Identity Pool and deleted it, but the issue remains.
	9.	Reviewed AWS Systems Manager (SSM):
	•	No parameters related to the directory.
	10.	Investigated Network Interfaces:

•	Found network interfaces created for the directory.
	•	Attempted to detach them but received an AuthFailure error:
An error occurred (AuthFailure) when calling the DetachNetworkInterface operation: You do not have permission to access the specified resource.

•	Even with full admin IAM permissions, I can’t detach or delete these interfaces.

11.	Attempted Directory Shutdown Steps:

•	Set domain controllers to 0 using:

aws ds update-number-of-domain-controllers --directory-id d-###### --desired-number 0

Disabled:
	•	Client authentication
	•	Directory data access
	•	LDAPS
	•	Radius
	•	Still unable to delete the directory.

The Problem:

Despite all these actions, the SimpleAD directory remains undeletable, constantly returning the error about “authorized applications,” even though no dependencies exist.

Has anyone encountered a similar issue? Is there a way to force the deletion of a SimpleAD directory in AWS? Or is this something that only AWS Support can resolve?

Thanks in advance for any guidance!

re:Post Agent · Answer

It appears you've encountered a common and frustrating issue with deleting AWS Directory Service resources, particularly SimpleAD directories. Despite your thorough efforts to remove all dependencies and authorized applications, the directory remains undeletable.

This situation often occurs due to lingering associations or internal references that are not easily visible or accessible through the standard AWS console or CLI commands. In some cases, there may be hidden or orphaned resources still linked to the directory, preventing its deletion.

Unfortunately, in many such scenarios, the resolution typically requires intervention from AWS Support. They have access to internal tools and processes that can manually remove these stubborn associations and force the deletion of the directory.

Since you've already taken extensive steps to remove all visible dependencies, your best course of action at this point would be to contact AWS Support. If you don't have a support plan that allows you to open a technical support case, you can still submit a billing support request. Explain that you're unable to delete the directory and that you don't want to be charged for a resource you can't remove.

When contacting support, provide them with all the details of the steps you've already taken. This will help them understand the situation more quickly and potentially expedite the resolution process.

In some cases, support may need to escalate the issue to the Directory Service team to manually remove any remaining authorized applications or hidden dependencies. Once they've done this, you should be able to delete the directory.

For future reference, it's worth noting that this is a known issue that has affected other AWS users as well. While AWS has safety precautions in place to prevent accidental deletion of resources that are still in use, sometimes these precautions can be overly restrictive and cause difficulties like the one you're experiencing.

In the meantime, continue to monitor your account for any unexpected charges related to this directory. If charges do occur while you're waiting for support to resolve the issue, make sure to include this information in your support request, as AWS may be able to provide credits for charges incurred due to this inability to delete the resource.  
**Sources**  
[I cannot disable my Directory Service | AWS re:Post](https://repost.aws/questions/QUvHPxX62xQw-8Lj_8QiyClg/i-cannot-disable-my-directory-service)  
[Directory Service Deletion Issues | AWS re:Post](https://repost.aws/questions/QU1UtH6UhzSrm7jUcTCBRQMA/directory-service-deletion-issues)  
[Cannot delete AD connector | AWS re:Post](https://repost.aws/questions/QUUj6XGschQ72rapiXfrCNHQ/cannot-delete-ad-connector)  
[Cannot delete AD connector | AWS re:Post](https://repost.aws/questions/QUPVfz75WmSW-vW0Ve0L1n_w/cannot-delete-ad-connector)

Cannot Delete AWS Directory Service (SimpleAD)

Add your answer

Relevant content